Wireshark · Ethereal-users: RE: [Ethereal-users] frequent question and request for the develo pers

[Richard Urwin <RUrwin@xxxxxxxxxxxxx>]

> In Ethereal's Ring Buffer a number of files are specified with file sizes
> and once the files are full the capture is finished.

This is not what the source code implies, and it is not what my copy of
Ethereal does.

> It could be done by going back to the first buffer after
> the last one was used

This behavior is implied by the source code, and exhibited by my copy of
Ethereal.
I am using 0.9.3 on WinNT 4.0 fully patched.

I have used 2 files of 10kbytes each, if I tried using 10 files of 10M it
would take too long to fill them. Can you try my test on your system and see
what happens? I enclose a screen grab of the capture dialog for comparison.


-- 
Richard Urwin, Software Design Engineer
Schenck Test Automation
Braemar Court, 1311b Melton Road, Syston, UK.
rurwin@xxxxxxxxxxxxx



-----Original Message-----
From: Eckert, Christopher [mailto:CEckert@xxxxxxxxxxxxxx]
Sent: Monday, May 20, 2002 5:39 PM
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] frequent question and request for the
developers


The ring buffer wrap question seems to come up a lot. What it seems people
are asking for is a wrap buffer, one which, once it reaches the end of the
buffer, it starts overwriting the beginning of the same buffer. That is
common in Sniffer and other brands. It is not something Ethereal does as I
understand it. 

In Ethereal's Ring Buffer a number of files are specified with file sizes
and once the files are full the capture is finished. In other programs, lets
use Sniffer as our example, a single buffer is wrapped. You can specify the
size of this single buffer like you can with Ethereal's ring buffers but
there is only one buffer file. when the maximum size of the file is reached
Sniffer starts writing over the beginning of it. Once the end of the file is
reached it again returns to the beginning of the file and so on and so
forth.

Wrap buffers are handy if you need to leave an analyzer capturing until you
have notification that a problem has occurred and then stop it. You simply
adjust the wrap file size to accommodate the amount of time to be still
stored in the buffer once you get notified. 

This is a common means of usage in the real world and would make Ethereal
much more useable. It could be done by going back to the first buffer after
the last one was used or by wrapping in the same file. Either way it would
be easy enough to train the user population. It would also stop the same
question from being asked over and over. Note that that should be taken as
an indicator of the worlds desire for this option.

I have cross posted this to the developers and documentation lists in hopes
of generating some clarification of this in the users guide and as a means
of begging the developers for this option to be looked into.

 

-----Original Message-----
From: pmarkham@xxxxxxxxxx [mailto:pmarkham@xxxxxxxxxx]
Sent: Monday, May 20, 2002 9:41 AM
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] Re: "ring mode" file size


Without fully understanding the intent of your question, I assume you
realize that 10000 kbytes is 10 megs of data per file?

As a consequence of careless reading, I first played with the filesize based
on the premise that the units were bytes. File changes 
do not take place rapidly when the data pipe is only a 56K dialup.... ;-) 

Peter

Karlheinz Mueller wrote:

> Is it possible that these 10 Files will be used as a kind "Ring Buffer".
> If all 10 files are filled up, then Ethereal will start at the first
> file again and overwrite.
 

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users

----------------------------------------------------------------------------
--
This e-mail transmission may contain information that is proprietary,
privileged and/or confidential and is intended exclusively for the person(s)
to whom it is addressed. Any use, copying, retention or disclosure by any
person other than the intended recipient or the intended recipient's
designees is strictly prohibited. If you have received this message in
error, please notify the sender immediately by return e-mail and delete all
copies.


============================================================================
==


_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users

_____________________________________________________________________
This message has been checked for all known viruses by UUNET delivered 
through the MessageLabs Virus Control Centre. For further information visit
http://www.uk.uu.net/products/security/virus/



________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com
________________________________________________________________________

Attachment: capturedialog.jpg
Description: JPEG image